svn commit: r1936207 - in httpd/httpd/branches/2.4.x: . changes-entries docs/manual/mod modules/md

Author: jorton
Date: Thu Jul 16 14:35:44 2026
New Revision: 1936207

Log:
Merge r1935184 from trunk:

* modules/md/mod_md_config.c: Flip MDServerStatus to disabled by
  default.

* docs/manual/mod/mod_md.xml: Update accordingly.

Reviewed by: rjung, jim, jorton

Added:
   httpd/httpd/branches/2.4.x/changes-entries/md-status.txt
      - copied unchanged from r1935184, httpd/httpd/trunk/changes-entries/md-status.txt
Modified:
   httpd/httpd/branches/2.4.x/   (props changed)
   httpd/httpd/branches/2.4.x/docs/manual/mod/mod_md.xml
   httpd/httpd/branches/2.4.x/modules/md/mod_md_config.c

Copied: httpd/httpd/branches/2.4.x/changes-entries/md-status.txt (from r1935184, httpd/httpd/trunk/changes-entries/md-status.txt)
==============================================================================
--- /dev/null	00:00:00 1970	(empty, because file is newly added)
+++ httpd/httpd/branches/2.4.x/changes-entries/md-status.txt	Thu Jul 16 14:35:44 2026	(r1936207, copy of r1935184, httpd/httpd/trunk/changes-entries/md-status.txt)
@@ -0,0 +1,3 @@
+  *) mod_md: MDServerStatus is now disabled by default.  [Joe Orton]
+
+

Modified: httpd/httpd/branches/2.4.x/docs/manual/mod/mod_md.xml
==============================================================================
--- httpd/httpd/branches/2.4.x/docs/manual/mod/mod_md.xml	Thu Jul 16 14:34:53 2026	(r1936206)
+++ httpd/httpd/branches/2.4.x/docs/manual/mod/mod_md.xml	Thu Jul 16 14:35:44 2026	(r1936207)
@@ -1114,17 +1114,20 @@ MDMessageCmd /etc/apache/md-message
         <name>MDServerStatus</name>
         <description>Control if Managed Domain information is added to <code>server-status</code>.</description>
         <syntax>MDServerStatus on|off</syntax>
-        <default>MDServerStatus on</default>
+        <default>MDServerStatus off</default>
         <contextlist>
             <context>server config</context>
         </contextlist>
         <usage>
             <p>
-                Apaches '<code>server-status</code>' handler allows you configure a resource to monitor
-                what is going on. This includes now a section listing all Managed Domains
-                with the DNS names, renewal status, lifetimes and main properties.
+                If enabled, adds a section to the
+                <module>mod_status</module> '<code>server-status</code>' handler
+                output which lists all Managed Domains with the DNS
+                names, renewal status, lifetimes and main properties.
             </p><p>
-                You can switch that off using this directive.
+                As with '<code>md-status</code>', the '<code>server-status</code>' output
+                <strong>must</strong> be protected from public view
+                using appropriate authorization restrictions.
             </p>
         </usage>
     </directivesynopsis>

Modified: httpd/httpd/branches/2.4.x/modules/md/mod_md_config.c
==============================================================================
--- httpd/httpd/branches/2.4.x/modules/md/mod_md_config.c	Thu Jul 16 14:34:53 2026	(r1936206)
+++ httpd/httpd/branches/2.4.x/modules/md/mod_md_config.c	Thu Jul 16 14:35:44 2026	(r1936207)
@@ -77,7 +77,7 @@ static md_mod_conf_t defmc = {
     NULL,                      /* message cmd */
     NULL,                      /* env table */
     0,                         /* dry_run flag */
-    1,                         /* server_status_enabled */
+    0,                         /* server_status_enabled */
     1,                         /* certificate_status_enabled */
     &def_ocsp_keep_window,     /* default time to keep ocsp responses */
     &def_ocsp_renew_window,    /* default time to renew ocsp responses */